App Store Connect Mcp

io.github.devinwangPublished by GitHub account devinwangv0.5.0Updated Nov 4, 2026

MCP server for Apple's App Store Connect API: 1316 tools generated from the official OpenAPI spec.

VerifiedSTDIODesktop onlyDeveloper Tools Data & Analytics Business & Commerce

Server details

Identifier: io.github.devinwang/app-store-connect-mcp
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Oct 21, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account devinwang for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.devinwang%2Fapp-store-connect-mcp.svg)](https://sourceweft.com/mcp/io.github.devinwang%2Fapp-store-connect-mcp?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Local MCP server exposing Apple's App Store Connect API as 1316 tools, so an assistant can manage apps, TestFlight, IAP, reviews, analytics and Xcode Cloud.

What you can do: Manage local App Store Connect accounts: add, list, switch, update, remove, and check JWT readiness
Read and write app metadata: app infos, versions, localizations, screenshots and previews, pricing and availability
Run TestFlight and review workflows: beta groups and testers, builds, review submissions, customer review responses
Manage in-app purchases and subscriptions, Game Center, App Clips, privacy and age-rating declarations
Operate Xcode Cloud builds and pull analytics, sales and finance reports, including upload and wait helpers
When to use it: Useful when you drive App Store Connect from an AI assistant: submission automation, TestFlight management, IAP and subscription catalogs, review triage, analytics pulls or Xcode Cloud orchestration. It suits teams that want full API coverage rather than a small hand-picked tool set.
Requirements: Runs locally over stdio, installed from npm (apple-app-store-connect-mcp) or run with npx; Node.js needed. Requires an App Store Connect API key: Key ID, Issuer ID and the absolute path to a downloaded .p8 file, registered via accounts_add or the ASC_KEY_ID, ASC_ISSUER_ID and ASC_PRIVATE_KEY_PATH variables. Optional ASC_ACCOUNT pins one account per process. Network access to Apple's API.

Before you install

The .p8 private key grants API access to your App Store Connect account; keep it outside any git repo and grant the narrowest role, since Admin allows deleting store metadata. Many tools write, change or delete store data, and an account switch is global across projects unless ASC_ACCOUNT is pinned. Apple logs every call against the key id; revoke the key if misuse is suspected.

Installation

In SourceWeft

Open App Store Connect Mcp in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

app-store-connect-mcp

The complete Model Context Protocol (MCP) server for Apple's App Store Connect API. 1316 tools. 100% coverage of every non-deprecated operation in Apple's official OpenAPI spec — TestFlight, Xcode Cloud, Game Center, App Clips, in-app purchases, subscriptions, review submissions, analytics, provisioning, and everything else Apple exposes. Works with Claude, Cursor, VS Code Copilot, Codex CLI, Gemini CLI, Windsurf, or any MCP client.

[npm version] [npm downloads] [CI] [License: MIT] [Node] [Tools: 1316] [Spec: 4.3] [MCP] [TypeScript]

See also: google-play-developer-mcp — the same philosophy for the Google Play Console.

Why this exists

App Store Connect is huge. Apple's own OpenAPI spec currently lists 1303 operations across 203 resource groups — TestFlight, Xcode Cloud, Game Center, App Clips, in-app purchases, subscriptions, offer codes, review submissions, alternative distribution (EU DMA), analytics, metrics, privacy manifests, provisioning, users… the list goes on.

Every community MCP covers a slice. None covers everything.

app-store-connect-mcp does.

Property	This server	Typical community MCP
App Store Connect API coverage	✅ 1300+ tools (100% of spec v4.5.1)	Partial (usually 50–150 tools)
Xcode Cloud	✅ all `ciProducts` / `ciWorkflows` / `ciBuildRuns` / `ciBuildActions` / `ciArtifacts` / `ciIssues` / `ciTestResults`	❌
Game Center	✅ achievements, leaderboards, groups, matchmaking, vocabularies	❌
App Clips	✅ default + advanced experiences, review details, header images	❌
Review Submissions v2	✅	Often still on the legacy `appStoreVersionSubmissions`
Alternative distribution (EU DMA)	✅	❌
App data usages (privacy)	✅	❌
Multi-account (switch between dev accounts)	✅ local registry + per-project `ASC_ACCOUNT` pin	Usually one
Credential safety	No `.p8` content in repo, no keys in the process cache, strict `.gitignore`	Varies
Spec-driven — auto-regenerate on new spec	✅ `npm run codegen`	❌

If you drive App Store Connect with an AI assistant — submission automation, TestFlight management, IAP / subscription catalog, review triage, analytics, or Xcode Cloud orchestration — this gives the assistant the full toolbox in one install.

Feature matrix

1316 tools total (as of spec v4.5.1):

6 accounts_* — local multi-account registry (add / list / switch / remove / update / current)
2 auth_* — auth_status (readiness) and auth_revoke_cache
1303 auto-generated from the official App Store Connect OpenAPI spec, one per operation, covering every resource group:
- Apps / App Infos / App Store Versions / App Store Version Localizations / Phased Releases / Version Submissions
- Review Submissions (v2) + Review Submission Items + App Store Review Attachments + App Store Review Details
- TestFlight: Beta Groups, Beta Testers, Beta App Review Details/Submissions, Beta App Localizations, Beta Build Localizations, Beta License Agreements, Beta Feedback Screenshot/Crash Submissions, Beta Invitees, Builds, Build Bundles, Build Bundle File Sizes
- Xcode Cloud: Ci Products, Ci Workflows, Ci Build Runs, Ci Build Actions, Ci Artifacts, Ci Issues, Ci Test Results, Ci Xcode Versions, Ci Mac Os Versions, Ci Scm Repositories / References / Pull Requests / Providers
- Game Center: Achievements, Leaderboards, Leaderboard Sets, Groups, Matchmaking Queues / Rule Sets / Rules / Teams, Activities, Player Scores / Achievements, App Versions, Enabled Versions, Details, Vocabularies, plus all Localizations / Images / Releases
- App Clips: App Clips, Default / Advanced Experiences, Default / Advanced Experience Localizations, Header Images, Advanced Experience Images, App Store Review Details
- In-App Purchases: IAP v2, Subscriptions, Subscription Groups, Subscription Offer Codes (custom + one-time-use), Subscription Prices, Subscription Promotional Offers, Subscription Introductory Offers, Subscription Availabilities, Win-back Offers, Promoted Purchases
- Pricing & Availability: App Prices, App Price Points, App Price Schedules, App Availabilities V2, Territories, Territory Availabilities
- Custom Product Pages + PPO (A/B testing): App Custom Product Pages, Versions, Localizations, App Store Version Experiments V2 + Treatments + Localizations
- Screenshots & Previews: App Screenshots, App Screenshot Sets, App Previews, App Preview Sets, App Event Screenshots, App Event Video Clips
- Provisioning: Bundle Ids, Bundle Id Capabilities, Certificates, Devices, Profiles, Pass Type Ids
- Users & Access: Users, User Invitations, Actors, Sandbox Testers
- Encryption / Compliance: App Encryption Declarations + Documents, Age Rating Declarations, App Data Usages + Categories + Purposes + Data Protections + Publish State, Accessibility Declarations, End User License Agreements
- Alternative Distribution (EU DMA): Alternative Distribution Keys, Domains, Packages, Package Versions / Variants / Deltas, Marketplace Search Details, Marketplace Webhooks
- Analytics: Analytics Reports, Report Requests, Report Instances, Report Segments, Diagnostic Signatures
- Metrics: App Perf, Build Perf, Power Perf, Diagnostic Logs
- Sales & Finance: Sales Reports, Finance Reports
- Reviews: Customer Reviews, Customer Review Responses
- Routing App Coverages, App Categories, App Events + Localizations, Android ↔ iOS App Mapping, External Purchase Collectors…
- Spec 4.5 additions: App Asset Libraries (images, videos, placements), In-App Purchase / Subscription / Subscription Group Versions with V2 localizations and images, Subscription Plan Availabilities, Game Center Score Moderations and Blocked Players, App Performance Overviews
5 hand-written helpers for flows that don't map cleanly to a single operation:
- asset_upload_file — step 2 of the 3-step asset upload protocol (screenshots, previews, review attachments, IAP review screenshots, App Clip header images, Game Center images, routing app coverages)
- sales_reports_download — downloads and un-gzips sales reports, returns parsed TSV
- finance_reports_download — same for finance reports
- analytics_report_instance_wait — poll until a report is COMPLETED/FAILED
- ci_build_run_wait — poll an Xcode Cloud build run to completion

Run auth_status, then apps_get_collection to verify end-to-end.

Quick start

Install from npm:

Or run without installing:

About the package name. The package on npm is apple-app-store-connect-mcp. After install, the command on your $PATH is app-store-connect-mcp (the bin name) — that's what your MCP client config below points at.

Then add to your MCP client config (example, Claude Code):

Finally, register your App Store Connect API key (details below):

accounts_add  name: my-app  keyId: AB12CD34EF  issuerId: 69a6de70-...  keyFile: /Users/you/.config/app-store-connect-mcp/AuthKey_AB12CD34EF.p8

accounts_add  name: my-app  keyId: AB12CD34EF  issuerId: 69a6de70-...  keyFile: /Users/you/.config/app-store-connect-mcp/AuthKey_AB12CD34EF.p8

Step-by-step setup

1. Create an App Store Connect API key

Open App Store Connect.
Users and Access → Integrations → App Store Connect API.
Click Generate API Key (requires Account Holder or Admin role).
Name it, choose the access level you want (Admin, Developer, Finance, Marketing, etc.), and Generate.
Copy the Key ID and Issuer ID (displayed at the top of the page).
Click Download API Key. This gives you an AuthKey_<KEYID>.p8 file. You only get this download once. Store it outside any git repo, for example at ~/.config/app-store-connect-mcp/AuthKey_AB12CD34EF.p8 with chmod 600.

2. Register the key with this MCP server

Launch any MCP client that has the server configured, then call:

accounts_add  name: my-app  keyId: <the 10-char Key ID>  issuerId: <the UUID shown above the API keys list>  keyFile: /absolute/path/to/AuthKey_XXXXXXXXXX.p8  description: (optional)

accounts_add  name: my-app  keyId: <the 10-char Key ID>  issuerId: <the UUID shown above the API keys list>  keyFile: /absolute/path/to/AuthKey_XXXXXXXXXX.p8  description: (optional)

3. Verify

Should return { source: "accounts", tokenAcquired: true, expiresAt: ... }.

Lists the apps the key can see.

4. Managing multiple accounts

accounts_add    name: client-a  keyId: ... issuerId: ... keyFile: ...accounts_add    name: client-b  keyId: ... issuerId: ... keyFile: ...accounts_switch name: client-baccounts_list

accounts_add    name: client-a  keyId: ... issuerId: ... keyFile: ...accounts_add    name: client-b  keyId: ... issuerId: ... keyFile: ...accounts_switch name: client-baccounts_list

All subsequent calls target the currently-switched account.

5. Pinning one account per project (`ASC_ACCOUNT`)

currentAccount is a single global value in accounts.json, shared by every MCP client on the machine. If you work on more than one App Store Connect account, that is a footgun: an accounts_switch in one project silently retargets every other project, and an assistant in project A can end up writing to account B's apps.

Pin the account per server process instead. Set ASC_ACCOUNT in the MCP client config:

json

{  "mcpServers": {    "app-store-connect": {      "command": "app-store-connect-mcp",      "env": { "ASC_ACCOUNT": "acme-app" }    }  }}

{  "mcpServers": {    "app-store-connect": {      "command": "app-store-connect-mcp",      "env": { "ASC_ACCOUNT": "acme-app" }    }  }}

With a pin in effect:

Every call resolves to that account, whatever currentAccount happens to be.
accounts_switch to any other account fails loudly instead of silently retargeting.
accounts_remove refuses to delete the pinned account.
auth_status and accounts_current report pinnedTo, so it is always visible which account a session is on.

If ASC_ACCOUNT names an account that isn't registered, calls fail with an explicit error rather than falling back to some other account.

Give each project its own pin — then no project depends on the shared global at all.

Environment-variable compatibility mode

For compatibility with older setups (e.g. zelentsov-dev/asc-mcp), the server also accepts:

If no account is registered via accounts_add, the server falls back to these env vars. accounts_* tools always take precedence.

Register with your MCP client

Claude Desktop

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%/Claude/claude_desktop_config.json

Claude Code

Or edit ~/.claude.json:

If you work on more than one App Store Connect account, put the server in each project's .mcp.json instead and pin it — see Pinning one account per project:

json

{  "mcpServers": {    "app-store-connect": {      "command": "app-store-connect-mcp",      "env": { "ASC_ACCOUNT": "acme-app" }    }  }}

{  "mcpServers": {    "app-store-connect": {      "command": "app-store-connect-mcp",      "env": { "ASC_ACCOUNT": "acme-app" }    }  }}

Cursor

Settings → MCP → Add new MCP server:

VS Code (GitHub Copilot agent mode)

.vscode/mcp.json:

json

{  "servers": {    "app-store-connect": {      "type": "stdio",      "command": "app-store-connect-mcp"    }  }}

{  "servers": {    "app-store-connect": {      "type": "stdio",      "command": "app-store-connect-mcp"    }  }}

Codex CLI / Gemini CLI / Windsurf / Continue

Any MCP-compliant client accepts the same command entry — point it at the globally installed app-store-connect-mcp binary, or at node /path/to/dist/index.js when running from source.

Running from source (no global install)

bash

git clone https://github.com/devinwang/app-store-connect-mcp.gitcd app-store-connect-mcpnpm installnpm run build

git clone https://github.com/devinwang/app-store-connect-mcp.gitcd app-store-connect-mcpnpm installnpm run build

Then in your MCP client config:

json

{  "mcpServers": {    "app-store-connect": {      "command": "node",      "args": ["/absolute/path/to/app-store-connect-mcp/dist/index.js"]    }  }}

{  "mcpServers": {    "app-store-connect": {      "command": "node",      "args": ["/absolute/path/to/app-store-connect-mcp/dist/index.js"]    }  }}

Usage examples

Check which apps your key can see

Fetch a build by version + buildNumber and submit it to TestFlight

builds_get_collection  "filter[preReleaseVersion.version]": "1.2.0"  "filter[version]": "147"
beta_groups_get_collection  "filter[app]": <APP_ID>  "fields[betaGroups]": "name,publicLinkEnabled"
builds_beta_groups_create_to_many_relationship  id: <BUILD_ID>  body:    data:      - type: betaGroups        id: <BETA_GROUP_ID>
builds_update_instance  id: <BUILD_ID>  body:    data:      type: builds      id: <BUILD_ID>      attributes:        expired: false

builds_get_collection  "filter[preReleaseVersion.version]": "1.2.0"  "filter[version]": "147"
beta_groups_get_collection  "filter[app]": <APP_ID>  "fields[betaGroups]": "name,publicLinkEnabled"
builds_beta_groups_create_to_many_relationship  id: <BUILD_ID>  body:    data:      - type: betaGroups        id: <BETA_GROUP_ID>
builds_update_instance  id: <BUILD_ID>  body:    data:      type: builds      id: <BUILD_ID>      attributes:        expired: false

Upload a screenshot (3-step asset flow)

app_screenshots_create_instance  body:    data:      type: appScreenshots      attributes:        fileName: "en-US-iphone-6_9-1.png"        fileSize: 2415122      relationships:        appScreenshotSet:          data: { type: appScreenshotSets, id: <SET_ID> }# → response includes the new `data.id` (asset is now AWAITING_UPLOAD)
asset_upload_file  filePath: /abs/path/to/screenshot.png  assetType: appScreenshots     # preferred: tool fetches uploadOperations  assetId: <SCREENSHOT_ID>      #           server-side (signature stays server-side)# (legacy: pass `uploadOperations: [...]` from the create response instead)
app_screenshots_update_instance  id: <SCREENSHOT_ID>  body:    data:      type: appScreenshots      id: <SCREENSHOT_ID>      attributes:        uploaded: true        sourceFileChecksum: <MD5>

app_screenshots_create_instance  body:    data:      type: appScreenshots      attributes:        fileName: "en-US-iphone-6_9-1.png"        fileSize: 2415122      relationships:        appScreenshotSet:          data: { type: appScreenshotSets, id: <SET_ID> }# → response includes the new `data.id` (asset is now AWAITING_UPLOAD)
asset_upload_file  filePath: /abs/path/to/screenshot.png  assetType: appScreenshots     # preferred: tool fetches uploadOperations  assetId: <SCREENSHOT_ID>      #           server-side (signature stays server-side)# (legacy: pass `uploadOperations: [...]` from the create response instead)
app_screenshots_update_instance  id: <SCREENSHOT_ID>  body:    data:      type: appScreenshots      id: <SCREENSHOT_ID>      attributes:        uploaded: true        sourceFileChecksum: <MD5>

Trigger an Xcode Cloud build and wait for completion

ci_build_runs_create_instance  body:    data:      type: ciBuildRuns      relationships:        workflow:          data: { type: ciWorkflows, id: <WORKFLOW_ID> }# → response includes `data.id`
ci_build_run_wait  id: <BUILD_RUN_ID>  timeoutMs: 3600000

ci_build_runs_create_instance  body:    data:      type: ciBuildRuns      relationships:        workflow:          data: { type: ciWorkflows, id: <WORKFLOW_ID> }# → response includes `data.id`
ci_build_run_wait  id: <BUILD_RUN_ID>  timeoutMs: 3600000

Respond to a customer review

customer_reviews_get_collection  "filter[app]": <APP_ID>  "sort": "-createdDate"  "limit": 10
customer_review_responses_v1_create_instance  body:    data:      type: customerReviewResponses      attributes:        responseBody: "Thanks for the feedback — we fixed this crash in 1.2.1. Please give it another try!"      relationships:        review:          data: { type: customerReviews, id: <REVIEW_ID> }

customer_reviews_get_collection  "filter[app]": <APP_ID>  "sort": "-createdDate"  "limit": 10
customer_review_responses_v1_create_instance  body:    data:      type: customerReviewResponses      attributes:        responseBody: "Thanks for the feedback — we fixed this crash in 1.2.1. Please give it another try!"      relationships:        review:          data: { type: customerReviews, id: <REVIEW_ID> }

Pull a sales report (one day)

sales_reports_download  "filter[frequency]": DAILY  "filter[reportType]": SALES  "filter[reportSubType]": SUMMARY  "filter[vendorNumber]": "12345678"  "filter[reportDate]": "2026-04-20"

sales_reports_download  "filter[frequency]": DAILY  "filter[reportType]": SALES  "filter[reportSubType]": SUMMARY  "filter[vendorNumber]": "12345678"  "filter[reportDate]": "2026-04-20"

Returns parsed rows. Add parse: false to get raw TSV.

Create + activate a subscription

subscription_groups_create_instance  body: { data: { type: subscriptionGroups, attributes: { referenceName: "Premium" }, relationships: { app: { data: { type: apps, id: <APP_ID> } } } } }
subscriptions_create_instance  body: { data: { type: subscriptions, attributes: { productId: "com.example.premium.monthly", name: "Premium Monthly", subscriptionPeriod: "ONE_MONTH" }, relationships: { group: { data: { type: subscriptionGroups, id: <GROUP_ID> } } } } }
subscription_prices_create_instance  body: { data: { type: subscriptionPrices, relationships: { subscription: { data: { type: subscriptions, id: <SUB_ID> } }, territory: { data: { type: territories, id: "USA" } }, subscriptionPricePoint: { data: { type: subscriptionPricePoints, id: <PRICE_POINT_ID> } } } } }

subscription_groups_create_instance  body: { data: { type: subscriptionGroups, attributes: { referenceName: "Premium" }, relationships: { app: { data: { type: apps, id: <APP_ID> } } } } }
subscriptions_create_instance  body: { data: { type: subscriptions, attributes: { productId: "com.example.premium.monthly", name: "Premium Monthly", subscriptionPeriod: "ONE_MONTH" }, relationships: { group: { data: { type: subscriptionGroups, id: <GROUP_ID> } } } } }
subscription_prices_create_instance  body: { data: { type: subscriptionPrices, relationships: { subscription: { data: { type: subscriptions, id: <SUB_ID> } }, territory: { data: { type: territories, id: "USA" } }, subscriptionPricePoint: { data: { type: subscriptionPricePoints, id: <PRICE_POINT_ID> } } } } }

Migrating from `asc-mcp` (zelentsov-dev)

This server replaces github.com/zelentsov-dev/asc-mcp. Key differences:

Scope. That server implements ~90 tools; this one implements all 1303 spec operations plus helpers.
Tool names. zelentsov-dev/asc-mcp uses simplified names like apps_search, reviews_list, app_versions_submit_for_review. This server uses Apple's official operationId snake-cased — apps_get_collection, customer_reviews_get_collection, review_submissions_create_instance. There's no auto-translation: update any prompts or scripts that assumed the old names.
Credential compat. The same env vars (ASC_KEY_ID, ASC_ISSUER_ID, ASC_PRIVATE_KEY_PATH) still work, so you don't need to move the .p8 to migrate. You'll get a one-time stderr warning recommending you register via accounts_add for multi-account support.
company_* → accounts_*. Rename mental model: a "company" in the old server is an "account" here.

A comprehensive name-by-name mapping is included in docs/MIGRATION.md.

Security

This repo ships with zero credentials. You bring an App Store Connect API .p8; the server records only its path.

What is and isn't on disk

Where	What
`~/.app-store-connect-mcp/accounts.json`	Account names, key ids, issuer ids, key-file paths, descriptions. No secrets. Written with `0600` permissions, directory `0700`.
Wherever you placed your `AuthKey_*.p8`	The actual private key. Never committed. Never copied into the server's memory longer than one JWT signing.
Repo contents	Code only. No fixtures, no example keys, no real key ids.

What's in memory

When	What
At JWT sign time	The `.p8` content is `readFileSync`'d, passed to `jwt.sign`, and the buffer is `fill(0)`-ed and dereferenced immediately after.
Between calls	A signed JWT (20-minute lifetime) is cached in a local variable in `token-cache.ts`. This is in-memory only — it is never persisted to disk. Dropped on `accounts_switch`, `accounts_update`, `accounts_remove`, and `auth_revoke_cache`.
In tool outputs	Everything is passed through `redact()` before emission. JWT-like strings, PEM blocks, `Bearer` tokens, and long hex tokens get replaced with `[REDACTED …]` — defense-in-depth against any code path accidentally logging.

`.gitignore` blocks

*.p8, AuthKey_*, AuthKey_*.p8
*.pem, *.p12, *.pfx, *.key, id_rsa*
accounts.json, .app-store-connect-mcp/
credentials/, keys/, secrets/
.env, .env.* (keeps .env.example)

Recommended hygiene

Keep your .p8 outside any git repo on your machine.
Grant the API key the narrowest role your workflow needs. Admin lets this MCP do anything including deleting store metadata. Restrict as appropriate.
Rotate the key periodically: revoke the old key in App Store Connect → Users and Access → Integrations, generate a new one, run accounts_update --keyFile <newPath>.
auth_status returns only the key id, issuer id, a boolean, and the JWT expiry timestamp. It never returns the JWT or the .p8 content.
The CI workflow in this repo fails the build if any private-key-material regex is detected in dist/.

Audit trail

Apple logs every API call against your key id. If you ever suspect misuse, open App Store Connect → Users and Access → Integrations and revoke the key; any outstanding JWTs signed with it stop working immediately.

Design notes

Spec-driven. 1303 of the 1316 tools are auto-generated from Apple's official OpenAPI spec (spec/app-store-connect-openapi.json). When Apple ships a new version, npm run spec:download && npm run codegen && npm run build is all it takes to update.
1:1 operationId naming. Tool names are Apple's operationId values converted to snake_case. This means the MCP names match the official REST reference, so when an LLM reads Apple's docs it can pick the right tool without translation.
Pragmatic input validation. Path params are typed zod strings (required), query params are typed zod fields (optional) with the exact bracketed names Apple uses (filter[name], fields[apps], limit[appStoreVersions]). Request bodies are z.record(z.unknown()) with a description pointing at the OpenAPI component schema — ASC validates them server-side and our error translator surfaces mistakes clearly. Generating full zod trees for every JSON:API envelope would balloon the server by 10× and add negligible value.
Error translation. 401 becomes "JWT rejected — rotate or check clock skew", 403 becomes "key isn't authorized for this endpoint", 422 surfaces the exact source.pointer from the ASC response, 429 explains the per-team quota, 5xx points at https://developer.apple.com/system-status/.
Stateless transport. stdio only. No network listener, no persistent state beyond the accounts file.
Zero telemetry. The server never phones home.

Contributing

PRs welcome. Before you submit:

npm run typecheck + npm run build pass on Node 18 / 20 / 22 (CI also runs this).
Never include a real .p8, a real keyId, a real issuerId, or a real JWT in an issue, PR, fixture, or example.
When you update to a new OpenAPI spec version:
1. npm run spec:download
2. npm run codegen — regenerates src/tools/generated/ and spec/coverage-report.txt
3. npm run build
4. Skim spec/coverage-report.txt diff — a delta of 10+ tools or a new top-level tag should get a CHANGELOG note.
New hand-written tools live in src/tools/overrides.ts and must have names that don't collide with any generated name.

Version history

0.1.0 — 2026-04-21 (first public release)

1221 MCP tools: 6 accounts, 2 auth, 1208 auto-generated from Apple's App Store Connect OpenAPI spec v4.3, 5 hand-written helpers (asset upload, sales/finance report download, polling).
100% spec coverage — every non-deprecated operation in the spec has a tool, and deprecated operations are still exposed with a [DEPRECATED] prefix.
Zero credentials in the repo. Strict .gitignore, .p8 content never cached in process memory, in-memory-only JWT cache, universal output redaction.
Multi-account via ~/.app-store-connect-mcp/accounts.json (path storage only).
Compatibility mode for ASC_KEY_ID / ASC_ISSUER_ID / ASC_PRIVATE_KEY_PATH env vars (drop-in replacement for zelentsov-dev/asc-mcp setups).
Spec-driven regeneration via npm run codegen.
Error translation for every common ASC failure mode.

References

License

MIT — see LICENSE.

Source: README.md at commit 00a92f9

Tools

200

accounts_list

List every App Store Connect account registered locally. Returns names, key ids, issuer ids, key-file paths, and descriptions. Never returns key material.

Takes no parameters.

accounts_current

Show which account is currently active. All subsequent API calls use this account's credentials. If `pinnedTo` is set, this server was pinned to that account via ASC_ACCOUNT and cannot be switched.

Takes no parameters.

accounts_add

Register a new App Store Connect account. Provide the Key ID, Issuer ID, and an absolute path to the `.p8` file. The key file stays on disk — the MCP records only its path.

ParametersnamerequiredkeyIdrequiredscopekeyFilerequiredissuerIdrequireddescription

accounts_remove

Remove an account from the local registry. Does NOT delete the `.p8` file on disk.

Parametersnamerequired

accounts_switch

Make an existing registered account the active one.

Parametersnamerequired

accounts_update

Change one or more fields of an existing account. Provide only the fields you want to update.

ParametersnamerequiredkeyIdscopekeyFileissuerIddescription

auth_status

Verify that the active account can acquire an App Store Connect JWT. Returns identifiers and a boolean readiness flag. Never returns the JWT itself or the `.p8` contents.

Takes no parameters.

auth_revoke_cache

Drop the in-memory JWT cache so the next API call re-signs. Useful after rotating the `.p8`.

Takes no parameters.

accessibility_declarations_create_instance

POST /v1/accessibilityDeclarations (POST /v1/accessibilityDeclarations) Body shape: see OpenAPI components.schemas.AccessibilityDeclarationCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

accessibility_declarations_get_instance

GET /v1/accessibilityDeclarations/{id} (GET /v1/accessibilityDeclarations/{id})

Parametersidrequiredfields_accessibilityDeclarations

accessibility_declarations_update_instance

PATCH /v1/accessibilityDeclarations/{id} (PATCH /v1/accessibilityDeclarations/{id}) Body shape: see OpenAPI components.schemas.AccessibilityDeclarationUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

accessibility_declarations_delete_instance

DELETE /v1/accessibilityDeclarations/{id} (DELETE /v1/accessibilityDeclarations/{id})

Parametersidrequired

actors_get_collection

GET /v1/actors (GET /v1/actors)

Parameterslimitfilter_idfields_actors

actors_get_instance

GET /v1/actors/{id} (GET /v1/actors/{id})

Parametersidrequiredfields_actors

age_rating_declarations_update_instance

PATCH /v1/ageRatingDeclarations/{id} (PATCH /v1/ageRatingDeclarations/{id}) Body shape: see OpenAPI components.schemas.AgeRatingDeclarationUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

alternative_distribution_domains_get_collection

GET /v1/alternativeDistributionDomains (GET /v1/alternativeDistributionDomains)

Parameterslimitfields_alternativeDistributionDomains

alternative_distribution_domains_create_instance

POST /v1/alternativeDistributionDomains (POST /v1/alternativeDistributionDomains) Body shape: see OpenAPI components.schemas.AlternativeDistributionDomainCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

alternative_distribution_domains_get_instance

GET /v1/alternativeDistributionDomains/{id} (GET /v1/alternativeDistributionDomains/{id})

Parametersidrequiredfields_alternativeDistributionDomains

alternative_distribution_domains_delete_instance

DELETE /v1/alternativeDistributionDomains/{id} (DELETE /v1/alternativeDistributionDomains/{id})

Parametersidrequired

alternative_distribution_keys_get_collection

GET /v1/alternativeDistributionKeys (GET /v1/alternativeDistributionKeys)

Parameterslimitexists_appfields_alternativeDistributionKeys

alternative_distribution_keys_create_instance

POST /v1/alternativeDistributionKeys (POST /v1/alternativeDistributionKeys) Body shape: see OpenAPI components.schemas.AlternativeDistributionKeyCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

alternative_distribution_keys_get_instance

GET /v1/alternativeDistributionKeys/{id} (GET /v1/alternativeDistributionKeys/{id})

Parametersidrequiredfields_alternativeDistributionKeys

alternative_distribution_keys_delete_instance

DELETE /v1/alternativeDistributionKeys/{id} (DELETE /v1/alternativeDistributionKeys/{id})

Parametersidrequired

alternative_distribution_package_deltas_get_instance

GET /v1/alternativeDistributionPackageDeltas/{id} (GET /v1/alternativeDistributionPackageDeltas/{id})

Parametersidrequiredfields_alternativeDistributionPackageDeltas

alternative_distribution_package_variants_get_instance

GET /v1/alternativeDistributionPackageVariants/{id} (GET /v1/alternativeDistributionPackageVariants/{id})

Parametersidrequiredfields_alternativeDistributionPackageVariants

alternative_distribution_package_versions_get_instance

GET /v1/alternativeDistributionPackageVersions/{id} (GET /v1/alternativeDistributionPackageVersions/{id})

Parametersidrequiredincludelimit_deltaslimit_variantsfields_alternativeDistributionPackagesfields_alternativeDistributionPackageDeltasfields_alternativeDistributionPackageVariantsfields_alternativeDistributionPackageVersions

alternative_distribution_package_versions_deltas_get_to_many_relationship

GET /v1/alternativeDistributionPackageVersions/{id}/relationships/deltas (GET /v1/alternativeDistributionPackageVersions/{id}/relationships/deltas)

Parametersidrequiredlimit

alternative_distribution_package_versions_variants_get_to_many_relationship

GET /v1/alternativeDistributionPackageVersions/{id}/relationships/variants (GET /v1/alternativeDistributionPackageVersions/{id}/relationships/variants)

Parametersidrequiredlimit

alternative_distribution_packages_create_instance

POST /v1/alternativeDistributionPackages (POST /v1/alternativeDistributionPackages) Body shape: see OpenAPI components.schemas.AlternativeDistributionPackageCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

alternative_distribution_packages_get_instance

GET /v1/alternativeDistributionPackages/{id} (GET /v1/alternativeDistributionPackages/{id})

Parametersidrequiredincludelimit_versionsfields_alternativeDistributionPackagesfields_alternativeDistributionPackageVersions

alternative_distribution_packages_versions_get_to_many_relationship

GET /v1/alternativeDistributionPackages/{id}/relationships/versions (GET /v1/alternativeDistributionPackages/{id}/relationships/versions)

Parametersidrequiredlimit

analytics_report_instances_get_instance

GET /v1/analyticsReportInstances/{id} (GET /v1/analyticsReportInstances/{id})

Parametersidrequiredfields_analyticsReportInstances

analytics_report_instances_segments_get_to_many_relationship

GET /v1/analyticsReportInstances/{id}/relationships/segments (GET /v1/analyticsReportInstances/{id}/relationships/segments)

Parametersidrequiredlimit

analytics_report_requests_create_instance

POST /v1/analyticsReportRequests (POST /v1/analyticsReportRequests) Body shape: see OpenAPI components.schemas.AnalyticsReportRequestCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

analytics_report_requests_get_instance

GET /v1/analyticsReportRequests/{id} (GET /v1/analyticsReportRequests/{id})

Parametersidrequiredincludelimit_reportsfields_analyticsReportsfields_analyticsReportRequests

analytics_report_requests_delete_instance

DELETE /v1/analyticsReportRequests/{id} (DELETE /v1/analyticsReportRequests/{id})

Parametersidrequired

analytics_report_requests_reports_get_to_many_relationship

GET /v1/analyticsReportRequests/{id}/relationships/reports (GET /v1/analyticsReportRequests/{id}/relationships/reports)

Parametersidrequiredlimit

analytics_report_segments_get_instance

GET /v1/analyticsReportSegments/{id} (GET /v1/analyticsReportSegments/{id})

Parametersidrequiredfields_analyticsReportSegments

analytics_reports_get_instance

GET /v1/analyticsReports/{id} (GET /v1/analyticsReports/{id})

Parametersidrequiredfields_analyticsReports

analytics_reports_instances_get_to_many_relationship

GET /v1/analyticsReports/{id}/relationships/instances (GET /v1/analyticsReports/{id}/relationships/instances)

Parametersidrequiredlimit

android_to_ios_app_mapping_details_create_instance

POST /v1/androidToIosAppMappingDetails (POST /v1/androidToIosAppMappingDetails) Body shape: see OpenAPI components.schemas.AndroidToIosAppMappingDetailCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

android_to_ios_app_mapping_details_get_instance

GET /v1/androidToIosAppMappingDetails/{id} (GET /v1/androidToIosAppMappingDetails/{id})

Parametersidrequiredfields_androidToIosAppMappingDetails

android_to_ios_app_mapping_details_update_instance

PATCH /v1/androidToIosAppMappingDetails/{id} (PATCH /v1/androidToIosAppMappingDetails/{id}) Body shape: see OpenAPI components.schemas.AndroidToIosAppMappingDetailUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

android_to_ios_app_mapping_details_delete_instance

DELETE /v1/androidToIosAppMappingDetails/{id} (DELETE /v1/androidToIosAppMappingDetails/{id})

Parametersidrequired

app_asset_libraries_get_instance

GET /v1/appAssetLibraries/{id} (GET /v1/appAssetLibraries/{id})

Parametersidrequiredfields_appAssetLibraries

app_asset_libraries_images_get_to_many_relationship

GET /v1/appAssetLibraries/{id}/relationships/images (GET /v1/appAssetLibraries/{id}/relationships/images)

Parametersidrequiredlimit

app_asset_libraries_videos_get_to_many_relationship

GET /v1/appAssetLibraries/{id}/relationships/videos (GET /v1/appAssetLibraries/{id}/relationships/videos)

Parametersidrequiredlimit

app_asset_library_images_create_instance

POST /v1/appAssetLibraryImages (POST /v1/appAssetLibraryImages) Body shape: see OpenAPI components.schemas.AppAssetLibraryImageCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_asset_library_images_get_instance

GET /v1/appAssetLibraryImages/{id} (GET /v1/appAssetLibraryImages/{id})

Parametersidrequiredincludelimit_placementsfields_appAssetLibraryImagesfields_appAssetLibraryPlacements

app_asset_library_images_update_instance

PATCH /v1/appAssetLibraryImages/{id} (PATCH /v1/appAssetLibraryImages/{id}) Body shape: see OpenAPI components.schemas.AppAssetLibraryImageUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_asset_library_images_delete_instance

DELETE /v1/appAssetLibraryImages/{id} (DELETE /v1/appAssetLibraryImages/{id})

Parametersidrequired

app_asset_library_images_placements_get_to_many_relationship

GET /v1/appAssetLibraryImages/{id}/relationships/placements (GET /v1/appAssetLibraryImages/{id}/relationships/placements)

Parametersidrequiredlimit

app_asset_library_placement_ordering_requests_create_instance

POST /v1/appAssetLibraryPlacementOrderingRequests (POST /v1/appAssetLibraryPlacementOrderingRequests) Body shape: see OpenAPI components.schemas.AppAssetLibraryPlacementOrderingRequestCreateRequest for the full JSON:API envelope.

Parametersbodyrequiredincludelimit_orderedPlacementsfields_appAssetLibraryPlacementsfields_appAssetLibraryPlacementOrderingRequests

app_asset_library_placements_create_instance

POST /v1/appAssetLibraryPlacements (POST /v1/appAssetLibraryPlacements) Body shape: see OpenAPI components.schemas.AppAssetLibraryPlacementCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_asset_library_placements_get_instance

GET /v1/appAssetLibraryPlacements/{id} (GET /v1/appAssetLibraryPlacements/{id})

Parametersidrequiredincludefields_appAssetLibraryImagesfields_appAssetLibraryVideosfields_appEventLocalizationsfields_appAssetLibraryPlacementsfields_appStoreVersionLocalizationsfields_appCustomProductPageLocalizationsfields_appStoreVersionExperimentTreatmentLocalizations

app_asset_library_placements_delete_instance

DELETE /v1/appAssetLibraryPlacements/{id} (DELETE /v1/appAssetLibraryPlacements/{id})

Parametersidrequired

app_asset_library_ref_data_get_collection

GET /v1/appAssetLibraryRefData (GET /v1/appAssetLibraryRefData)

Parametersfilter_specsfilter_featuresfilter_placementTypesfields_appAssetLibraryRefDatafilter_placementProfileGroups

app_asset_library_ref_data_get_instance

GET /v1/appAssetLibraryRefData/{id} (GET /v1/appAssetLibraryRefData/{id})

Parametersidrequiredfields_appAssetLibraryRefData

app_asset_library_videos_create_instance

POST /v1/appAssetLibraryVideos (POST /v1/appAssetLibraryVideos) Body shape: see OpenAPI components.schemas.AppAssetLibraryVideoCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_asset_library_videos_get_instance

GET /v1/appAssetLibraryVideos/{id} (GET /v1/appAssetLibraryVideos/{id})

Parametersidrequiredincludelimit_placementsfields_appAssetLibraryVideosfields_appAssetLibraryPlacements

app_asset_library_videos_update_instance

PATCH /v1/appAssetLibraryVideos/{id} (PATCH /v1/appAssetLibraryVideos/{id}) Body shape: see OpenAPI components.schemas.AppAssetLibraryVideoUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_asset_library_videos_delete_instance

DELETE /v1/appAssetLibraryVideos/{id} (DELETE /v1/appAssetLibraryVideos/{id})

Parametersidrequired

app_asset_library_videos_placements_get_to_many_relationship

GET /v1/appAssetLibraryVideos/{id}/relationships/placements (GET /v1/appAssetLibraryVideos/{id}/relationships/placements)

Parametersidrequiredlimit

app_availabilities_v2_create_instance

POST /v2/appAvailabilities (POST /v2/appAvailabilities) Body shape: see OpenAPI components.schemas.AppAvailabilityV2CreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_availabilities_v2_get_instance

GET /v2/appAvailabilities/{id} (GET /v2/appAvailabilities/{id})

Parametersidrequiredincludefields_appAvailabilitieslimit_territoryAvailabilitiesfields_territoryAvailabilities

app_availabilities_v2_territory_availabilities_get_to_many_relationship

GET /v2/appAvailabilities/{id}/relationships/territoryAvailabilities (GET /v2/appAvailabilities/{id}/relationships/territoryAvailabilities)

Parametersidrequiredlimit

app_categories_get_collection

GET /v1/appCategories (GET /v1/appCategories)

Parameterslimitincludeexists_parentfilter_platformslimit_subcategoriesfields_appCategories

app_categories_get_instance

GET /v1/appCategories/{id} (GET /v1/appCategories/{id})

Parametersidrequiredincludelimit_subcategoriesfields_appCategories

app_categories_parent_get_to_one_relationship

GET /v1/appCategories/{id}/relationships/parent (GET /v1/appCategories/{id}/relationships/parent)

Parametersidrequired

app_categories_subcategories_get_to_many_relationship

GET /v1/appCategories/{id}/relationships/subcategories (GET /v1/appCategories/{id}/relationships/subcategories)

Parametersidrequiredlimit

app_clip_advanced_experience_images_create_instance

POST /v1/appClipAdvancedExperienceImages (POST /v1/appClipAdvancedExperienceImages) Body shape: see OpenAPI components.schemas.AppClipAdvancedExperienceImageCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_clip_advanced_experience_images_get_instance

GET /v1/appClipAdvancedExperienceImages/{id} (GET /v1/appClipAdvancedExperienceImages/{id})

Parametersidrequiredfields_appClipAdvancedExperienceImages

app_clip_advanced_experience_images_update_instance

PATCH /v1/appClipAdvancedExperienceImages/{id} (PATCH /v1/appClipAdvancedExperienceImages/{id}) Body shape: see OpenAPI components.schemas.AppClipAdvancedExperienceImageUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_clip_advanced_experiences_create_instance

POST /v1/appClipAdvancedExperiences (POST /v1/appClipAdvancedExperiences) Body shape: see OpenAPI components.schemas.AppClipAdvancedExperienceCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_clip_advanced_experiences_get_instance

GET /v1/appClipAdvancedExperiences/{id} (GET /v1/appClipAdvancedExperiences/{id})

Parametersidrequiredincludefields_appClipslimit_localizationsfields_appClipAdvancedExperiencesfields_appClipAdvancedExperienceImagesfields_appClipAdvancedExperienceLocalizations

app_clip_advanced_experiences_update_instance

PATCH /v1/appClipAdvancedExperiences/{id} (PATCH /v1/appClipAdvancedExperiences/{id}) Body shape: see OpenAPI components.schemas.AppClipAdvancedExperienceUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_clip_app_store_review_details_create_instance

POST /v1/appClipAppStoreReviewDetails (POST /v1/appClipAppStoreReviewDetails) Body shape: see OpenAPI components.schemas.AppClipAppStoreReviewDetailCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_clip_app_store_review_details_get_instance

GET /v1/appClipAppStoreReviewDetails/{id} (GET /v1/appClipAppStoreReviewDetails/{id})

Parametersidrequiredincludefields_appClipDefaultExperiencesfields_appClipAppStoreReviewDetails

app_clip_app_store_review_details_update_instance

PATCH /v1/appClipAppStoreReviewDetails/{id} (PATCH /v1/appClipAppStoreReviewDetails/{id}) Body shape: see OpenAPI components.schemas.AppClipAppStoreReviewDetailUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_clip_default_experience_localizations_create_instance

POST /v1/appClipDefaultExperienceLocalizations (POST /v1/appClipDefaultExperienceLocalizations) Body shape: see OpenAPI components.schemas.AppClipDefaultExperienceLocalizationCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_clip_default_experience_localizations_get_instance

GET /v1/appClipDefaultExperienceLocalizations/{id} (GET /v1/appClipDefaultExperienceLocalizations/{id})

Parametersidrequiredincludefields_appClipHeaderImagesfields_appClipDefaultExperiencesfields_appClipDefaultExperienceLocalizations

app_clip_default_experience_localizations_update_instance

PATCH /v1/appClipDefaultExperienceLocalizations/{id} (PATCH /v1/appClipDefaultExperienceLocalizations/{id}) Body shape: see OpenAPI components.schemas.AppClipDefaultExperienceLocalizationUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_clip_default_experience_localizations_delete_instance

DELETE /v1/appClipDefaultExperienceLocalizations/{id} (DELETE /v1/appClipDefaultExperienceLocalizations/{id})

Parametersidrequired

app_clip_default_experience_localizations_app_clip_header_image_get_to_one_relationship

GET /v1/appClipDefaultExperienceLocalizations/{id}/relationships/appClipHeaderImage (GET /v1/appClipDefaultExperienceLocalizations/{id}/relationships/appClipHeaderImage)

Parametersidrequired

app_clip_default_experiences_create_instance

POST /v1/appClipDefaultExperiences (POST /v1/appClipDefaultExperiences) Body shape: see OpenAPI components.schemas.AppClipDefaultExperienceCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_clip_default_experiences_get_instance

GET /v1/appClipDefaultExperiences/{id} (GET /v1/appClipDefaultExperiences/{id})

Parametersidrequiredincludefields_appClipsfields_appStoreVersionsfields_appClipDefaultExperiencesfields_appClipAppStoreReviewDetailslimit_appClipDefaultExperienceLocalizationsfields_appClipDefaultExperienceLocalizations

app_clip_default_experiences_update_instance

PATCH /v1/appClipDefaultExperiences/{id} (PATCH /v1/appClipDefaultExperiences/{id}) Body shape: see OpenAPI components.schemas.AppClipDefaultExperienceUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_clip_default_experiences_delete_instance

DELETE /v1/appClipDefaultExperiences/{id} (DELETE /v1/appClipDefaultExperiences/{id})

Parametersidrequired

app_clip_default_experiences_app_clip_app_store_review_detail_get_to_one_relationship

GET /v1/appClipDefaultExperiences/{id}/relationships/appClipAppStoreReviewDetail (GET /v1/appClipDefaultExperiences/{id}/relationships/appClipAppStoreReviewDetail)

Parametersidrequired

app_clip_default_experiences_localizations_get_to_many_relationship

GET /v1/appClipDefaultExperiences/{id}/relationships/appClipDefaultExperienceLocalizations (GET /v1/appClipDefaultExperiences/{id}/relationships/appClipDefaultExperienceLocalizations)

Parametersidrequiredlimit

app_clip_default_experiences_release_with_app_store_version_get_to_one_relationship

GET /v1/appClipDefaultExperiences/{id}/relationships/releaseWithAppStoreVersion (GET /v1/appClipDefaultExperiences/{id}/relationships/releaseWithAppStoreVersion)

Parametersidrequired

app_clip_default_experiences_release_with_app_store_version_update_to_one_relationship

PATCH /v1/appClipDefaultExperiences/{id}/relationships/releaseWithAppStoreVersion (PATCH /v1/appClipDefaultExperiences/{id}/relationships/releaseWithAppStoreVersion) Body shape: see OpenAPI components.schemas.AppClipDefaultExperienceReleaseWithAppStoreVersionLinkageRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_clip_header_images_create_instance

POST /v1/appClipHeaderImages (POST /v1/appClipHeaderImages) Body shape: see OpenAPI components.schemas.AppClipHeaderImageCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_clip_header_images_get_instance

GET /v1/appClipHeaderImages/{id} (GET /v1/appClipHeaderImages/{id})

Parametersidrequiredincludefields_appClipHeaderImagesfields_appClipDefaultExperienceLocalizations

app_clip_header_images_update_instance

PATCH /v1/appClipHeaderImages/{id} (PATCH /v1/appClipHeaderImages/{id}) Body shape: see OpenAPI components.schemas.AppClipHeaderImageUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_clip_header_images_delete_instance

DELETE /v1/appClipHeaderImages/{id} (DELETE /v1/appClipHeaderImages/{id})

Parametersidrequired

app_clips_get_instance

GET /v1/appClips/{id} (GET /v1/appClips/{id})

Parametersidrequiredincludefields_appsfields_appClipslimit_appClipDefaultExperiencesfields_appClipDefaultExperiences

app_clips_app_clip_advanced_experiences_get_to_many_relationship

GET /v1/appClips/{id}/relationships/appClipAdvancedExperiences (GET /v1/appClips/{id}/relationships/appClipAdvancedExperiences)

Parametersidrequiredlimit

app_clips_app_clip_default_experiences_get_to_many_relationship

GET /v1/appClips/{id}/relationships/appClipDefaultExperiences (GET /v1/appClips/{id}/relationships/appClipDefaultExperiences)

Parametersidrequiredlimit

app_custom_product_page_localizations_create_instance

POST /v1/appCustomProductPageLocalizations (POST /v1/appCustomProductPageLocalizations) Body shape: see OpenAPI components.schemas.AppCustomProductPageLocalizationCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_custom_product_page_localizations_get_instance

GET /v1/appCustomProductPageLocalizations/{id} (GET /v1/appCustomProductPageLocalizations/{id})

Parametersidrequiredincludelimit_placementslimit_appPreviewSetslimit_searchKeywordsfields_appPreviewSetslimit_appScreenshotSetsfields_appScreenshotSetsfields_appAssetLibraryPlacementsfields_appCustomProductPageVersionsfields_appCustomProductPageLocalizations

app_custom_product_page_localizations_update_instance

PATCH /v1/appCustomProductPageLocalizations/{id} (PATCH /v1/appCustomProductPageLocalizations/{id}) Body shape: see OpenAPI components.schemas.AppCustomProductPageLocalizationUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_custom_product_page_localizations_delete_instance

DELETE /v1/appCustomProductPageLocalizations/{id} (DELETE /v1/appCustomProductPageLocalizations/{id})

Parametersidrequired

app_custom_product_page_localizations_app_preview_sets_get_to_many_relationship

GET /v1/appCustomProductPageLocalizations/{id}/relationships/appPreviewSets (GET /v1/appCustomProductPageLocalizations/{id}/relationships/appPreviewSets)

Parametersidrequiredlimit

app_custom_product_page_localizations_app_screenshot_sets_get_to_many_relationship

GET /v1/appCustomProductPageLocalizations/{id}/relationships/appScreenshotSets (GET /v1/appCustomProductPageLocalizations/{id}/relationships/appScreenshotSets)

Parametersidrequiredlimit

app_custom_product_page_localizations_placements_get_to_many_relationship

GET /v1/appCustomProductPageLocalizations/{id}/relationships/placements (GET /v1/appCustomProductPageLocalizations/{id}/relationships/placements)

Parametersidrequiredlimit

app_custom_product_page_localizations_search_keywords_get_to_many_relationship

GET /v1/appCustomProductPageLocalizations/{id}/relationships/searchKeywords (GET /v1/appCustomProductPageLocalizations/{id}/relationships/searchKeywords)

Parametersidrequiredlimit

app_custom_product_page_localizations_search_keywords_create_to_many_relationship

POST /v1/appCustomProductPageLocalizations/{id}/relationships/searchKeywords (POST /v1/appCustomProductPageLocalizations/{id}/relationships/searchKeywords) Body shape: see OpenAPI components.schemas.AppCustomProductPageLocalizationSearchKeywordsLinkagesRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_custom_product_page_localizations_search_keywords_delete_to_many_relationship

DELETE /v1/appCustomProductPageLocalizations/{id}/relationships/searchKeywords (DELETE /v1/appCustomProductPageLocalizations/{id}/relationships/searchKeywords) Body shape: see OpenAPI components.schemas.AppCustomProductPageLocalizationSearchKeywordsLinkagesRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_custom_product_page_versions_create_instance

POST /v1/appCustomProductPageVersions (POST /v1/appCustomProductPageVersions) Body shape: see OpenAPI components.schemas.AppCustomProductPageVersionCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_custom_product_page_versions_get_instance

GET /v1/appCustomProductPageVersions/{id} (GET /v1/appCustomProductPageVersions/{id})

Parametersidrequiredincludefields_appCustomProductPagesfields_appCustomProductPageVersionslimit_appCustomProductPageLocalizationsfields_appCustomProductPageLocalizations

app_custom_product_page_versions_update_instance

PATCH /v1/appCustomProductPageVersions/{id} (PATCH /v1/appCustomProductPageVersions/{id}) Body shape: see OpenAPI components.schemas.AppCustomProductPageVersionUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_custom_product_page_versions_localizations_get_to_many_relationship

GET /v1/appCustomProductPageVersions/{id}/relationships/appCustomProductPageLocalizations (GET /v1/appCustomProductPageVersions/{id}/relationships/appCustomProductPageLocalizations)

Parametersidrequiredlimit

app_custom_product_pages_create_instance

POST /v1/appCustomProductPages (POST /v1/appCustomProductPages) Body shape: see OpenAPI components.schemas.AppCustomProductPageCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_custom_product_pages_get_instance

GET /v1/appCustomProductPages/{id} (GET /v1/appCustomProductPages/{id})

Parametersidrequiredincludefields_appsfields_appCustomProductPageslimit_appCustomProductPageVersionsfields_appCustomProductPageVersions

app_custom_product_pages_update_instance

PATCH /v1/appCustomProductPages/{id} (PATCH /v1/appCustomProductPages/{id}) Body shape: see OpenAPI components.schemas.AppCustomProductPageUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_custom_product_pages_delete_instance

DELETE /v1/appCustomProductPages/{id} (DELETE /v1/appCustomProductPages/{id})

Parametersidrequired

app_custom_product_pages_app_custom_product_page_versions_get_to_many_relationship

GET /v1/appCustomProductPages/{id}/relationships/appCustomProductPageVersions (GET /v1/appCustomProductPages/{id}/relationships/appCustomProductPageVersions)

Parametersidrequiredlimit

app_encryption_declaration_documents_create_instance

POST /v1/appEncryptionDeclarationDocuments (POST /v1/appEncryptionDeclarationDocuments) Body shape: see OpenAPI components.schemas.AppEncryptionDeclarationDocumentCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_encryption_declaration_documents_get_instance

GET /v1/appEncryptionDeclarationDocuments/{id} (GET /v1/appEncryptionDeclarationDocuments/{id})

Parametersidrequiredfields_appEncryptionDeclarationDocuments

app_encryption_declaration_documents_update_instance

PATCH /v1/appEncryptionDeclarationDocuments/{id} (PATCH /v1/appEncryptionDeclarationDocuments/{id}) Body shape: see OpenAPI components.schemas.AppEncryptionDeclarationDocumentUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_encryption_declarations_get_collection

GET /v1/appEncryptionDeclarations (GET /v1/appEncryptionDeclarations)

Parameterslimitincludefilter_appfields_appslimit_buildsfields_buildsfilter_buildsfilter_platformfields_appEncryptionDeclarationsfields_appEncryptionDeclarationDocuments

app_encryption_declarations_create_instance

POST /v1/appEncryptionDeclarations (POST /v1/appEncryptionDeclarations) Body shape: see OpenAPI components.schemas.AppEncryptionDeclarationCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_encryption_declarations_get_instance

GET /v1/appEncryptionDeclarations/{id} (GET /v1/appEncryptionDeclarations/{id})

Parametersidrequiredincludefields_appslimit_buildsfields_buildsfields_appEncryptionDeclarationsfields_appEncryptionDeclarationDocuments

app_encryption_declarations_app_get_to_one_relationship

[DEPRECATED] GET /v1/appEncryptionDeclarations/{id}/relationships/app (GET /v1/appEncryptionDeclarations/{id}/relationships/app)

Parametersidrequired

app_encryption_declarations_app_encryption_declaration_document_get_to_one_relationship

GET /v1/appEncryptionDeclarations/{id}/relationships/appEncryptionDeclarationDocument (GET /v1/appEncryptionDeclarations/{id}/relationships/appEncryptionDeclarationDocument)

Parametersidrequired

app_encryption_declarations_builds_create_to_many_relationship

[DEPRECATED] POST /v1/appEncryptionDeclarations/{id}/relationships/builds (POST /v1/appEncryptionDeclarations/{id}/relationships/builds) Body shape: see OpenAPI components.schemas.AppEncryptionDeclarationBuildsLinkagesRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_event_localizations_create_instance

POST /v1/appEventLocalizations (POST /v1/appEventLocalizations) Body shape: see OpenAPI components.schemas.AppEventLocalizationCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_event_localizations_get_instance

GET /v1/appEventLocalizations/{id} (GET /v1/appEventLocalizations/{id})

Parametersidrequiredincludefields_appEventslimit_placementslimit_appEventVideoClipsfields_appEventVideoClipslimit_appEventScreenshotsfields_appEventScreenshotsfields_appEventLocalizationsfields_appAssetLibraryPlacements

app_event_localizations_update_instance

PATCH /v1/appEventLocalizations/{id} (PATCH /v1/appEventLocalizations/{id}) Body shape: see OpenAPI components.schemas.AppEventLocalizationUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_event_localizations_delete_instance

DELETE /v1/appEventLocalizations/{id} (DELETE /v1/appEventLocalizations/{id})

Parametersidrequired

app_event_localizations_app_event_screenshots_get_to_many_relationship

GET /v1/appEventLocalizations/{id}/relationships/appEventScreenshots (GET /v1/appEventLocalizations/{id}/relationships/appEventScreenshots)

Parametersidrequiredlimit

app_event_localizations_app_event_video_clips_get_to_many_relationship

GET /v1/appEventLocalizations/{id}/relationships/appEventVideoClips (GET /v1/appEventLocalizations/{id}/relationships/appEventVideoClips)

Parametersidrequiredlimit

app_event_localizations_placements_get_to_many_relationship

GET /v1/appEventLocalizations/{id}/relationships/placements (GET /v1/appEventLocalizations/{id}/relationships/placements)

Parametersidrequiredlimit

app_event_screenshots_create_instance

POST /v1/appEventScreenshots (POST /v1/appEventScreenshots) Body shape: see OpenAPI components.schemas.AppEventScreenshotCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_event_screenshots_get_instance

GET /v1/appEventScreenshots/{id} (GET /v1/appEventScreenshots/{id})

Parametersidrequiredincludefields_appEventScreenshotsfields_appEventLocalizations

app_event_screenshots_update_instance

PATCH /v1/appEventScreenshots/{id} (PATCH /v1/appEventScreenshots/{id}) Body shape: see OpenAPI components.schemas.AppEventScreenshotUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_event_screenshots_delete_instance

DELETE /v1/appEventScreenshots/{id} (DELETE /v1/appEventScreenshots/{id})

Parametersidrequired

app_event_video_clips_create_instance

POST /v1/appEventVideoClips (POST /v1/appEventVideoClips) Body shape: see OpenAPI components.schemas.AppEventVideoClipCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_event_video_clips_get_instance

GET /v1/appEventVideoClips/{id} (GET /v1/appEventVideoClips/{id})

Parametersidrequiredincludefields_appEventVideoClipsfields_appEventLocalizations

app_event_video_clips_update_instance

PATCH /v1/appEventVideoClips/{id} (PATCH /v1/appEventVideoClips/{id}) Body shape: see OpenAPI components.schemas.AppEventVideoClipUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_event_video_clips_delete_instance

DELETE /v1/appEventVideoClips/{id} (DELETE /v1/appEventVideoClips/{id})

Parametersidrequired

app_events_create_instance

POST /v1/appEvents (POST /v1/appEvents) Body shape: see OpenAPI components.schemas.AppEventCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_events_get_instance

GET /v1/appEvents/{id} (GET /v1/appEvents/{id})

Parametersidrequiredincludefields_appEventslimit_localizationsfields_appEventLocalizations

app_events_update_instance

PATCH /v1/appEvents/{id} (PATCH /v1/appEvents/{id}) Body shape: see OpenAPI components.schemas.AppEventUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_events_delete_instance

DELETE /v1/appEvents/{id} (DELETE /v1/appEvents/{id})

Parametersidrequired

app_events_localizations_get_to_many_relationship

GET /v1/appEvents/{id}/relationships/localizations (GET /v1/appEvents/{id}/relationships/localizations)

Parametersidrequiredlimit

app_info_localizations_create_instance

POST /v1/appInfoLocalizations (POST /v1/appInfoLocalizations) Body shape: see OpenAPI components.schemas.AppInfoLocalizationCreateRequest for the full JSON:API envelope.

Parametersbodyrequired

app_info_localizations_get_instance

GET /v1/appInfoLocalizations/{id} (GET /v1/appInfoLocalizations/{id})

Parametersidrequiredincludefields_appInfosfields_appInfoLocalizations

app_info_localizations_update_instance

PATCH /v1/appInfoLocalizations/{id} (PATCH /v1/appInfoLocalizations/{id}) Body shape: see OpenAPI components.schemas.AppInfoLocalizationUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_info_localizations_delete_instance

DELETE /v1/appInfoLocalizations/{id} (DELETE /v1/appInfoLocalizations/{id})

Parametersidrequired

app_infos_get_instance

GET /v1/appInfos/{id} (GET /v1/appInfos/{id})

Parametersidrequiredincludefields_appsfields_appInfosfields_appCategorieslimit_appInfoLocalizationsfields_appInfoLocalizationsfields_ageRatingDeclarations

app_infos_update_instance

PATCH /v1/appInfos/{id} (PATCH /v1/appInfos/{id}) Body shape: see OpenAPI components.schemas.AppInfoUpdateRequest for the full JSON:API envelope.

Parametersidrequiredbodyrequired

app_infos_age_rating_declaration_get_to_one_relationship

GET /v1/appInfos/{id}/relationships/ageRatingDeclaration (GET /v1/appInfos/{id}/relationships/ageRatingDeclaration)

Parametersidrequired

app_infos_app_info_localizations_get_to_many_relationship

GET /v1/appInfos/{id}/relationships/appInfoLocalizations (GET /v1/appInfos/{id}/relationships/appInfoLocalizations)

Parametersidrequiredlimit

app_infos_primary_category_get_to_one_relationship

GET /v1/appInfos/{id}/relationships/primaryCategory (GET /v1/appInfos/{id}/relationships/primaryCategory)

Parametersidrequired

app_infos_primary_subcategory_one_get_to_one_relationship

GET /v1/appInfos/{id}/relationships/primarySubcategoryOne (GET /v1/appInfos/{id}/relationships/primarySubcategoryOne)

Parametersidrequired

app_infos_primary_subcategory_two_get_to_one_relationship

GET /v1/appInfos/{id}/relationships/primarySubcategoryTwo (GET /v1/appInfos/{id}/relationships/primarySubcategoryTwo)

Parametersidrequired

app_infos_secondary_category_get_to_one_relationship

GET /v1/appInfos/{id}/relationships/secondaryCategory (GET /v1/appInfos/{id}/relationships/secondaryCategory)

Parametersidrequired

app_infos_secondary_subcategory_one_get_to_one_relationship

GET /v1/appInfos/{id}/relationships/secondarySubcategoryOne (GET /v1/appInfos/{id}/relationships/secondarySubcategoryOne)

Parametersidrequired

app_infos_secondary_subcategory_two_get_to_one_relationship

GET /v1/appInfos/{id}/relationships/secondarySubcategoryTwo (GET /v1/appInfos/{id}/relationships/secondarySubcategoryTwo)

Parametersidrequired

Version history

v0.5.0LatestOct 21, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listedRequired15 pts
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts

App Store Connect Mcp

Overview

Installation

In SourceWeft

Other MCP clients

README

app-store-connect-mcp

Table of Contents

Why this exists

Feature matrix

Quick start

Step-by-step setup

1. Create an App Store Connect API key

2. Register the key with this MCP server

3. Verify

4. Managing multiple accounts

5. Pinning one account per project (ASC_ACCOUNT)

Environment-variable compatibility mode

Register with your MCP client

Claude Desktop

Claude Code

Cursor

VS Code (GitHub Copilot agent mode)

Codex CLI / Gemini CLI / Windsurf / Continue

Running from source (no global install)

Usage examples

Check which apps your key can see

Fetch a build by version + buildNumber and submit it to TestFlight

Upload a screenshot (3-step asset flow)

Trigger an Xcode Cloud build and wait for completion

Respond to a customer review

Pull a sales report (one day)

Create + activate a subscription

Migrating from asc-mcp (zelentsov-dev)

Security

What is and isn't on disk

What's in memory

.gitignore blocks

Recommended hygiene

Audit trail

Design notes

Contributing

Version history

0.1.0 — 2026-04-21 (first public release)

References

License

Tools

accounts_list

accounts_current

accounts_add

accounts_remove

accounts_switch

accounts_update

auth_status

auth_revoke_cache

accessibility_declarations_create_instance

accessibility_declarations_get_instance

accessibility_declarations_update_instance

accessibility_declarations_delete_instance

actors_get_collection

actors_get_instance

age_rating_declarations_update_instance

alternative_distribution_domains_get_collection

alternative_distribution_domains_create_instance

alternative_distribution_domains_get_instance

alternative_distribution_domains_delete_instance

alternative_distribution_keys_get_collection

alternative_distribution_keys_create_instance

alternative_distribution_keys_get_instance

alternative_distribution_keys_delete_instance

alternative_distribution_package_deltas_get_instance

alternative_distribution_package_variants_get_instance

alternative_distribution_package_versions_get_instance

alternative_distribution_package_versions_deltas_get_to_many_relationship

alternative_distribution_package_versions_deltas_get_to_many_related

alternative_distribution_package_versions_variants_get_to_many_relationship

alternative_distribution_package_versions_variants_get_to_many_related

alternative_distribution_packages_create_instance

alternative_distribution_packages_get_instance

alternative_distribution_packages_versions_get_to_many_relationship

5. Pinning one account per project (`ASC_ACCOUNT`)

Migrating from `asc-mcp` (zelentsov-dev)

`.gitignore` blocks